diff options
author | V3n3RiX <venerix@redcorelinux.org> | 2020-04-12 03:41:30 +0100 |
---|---|---|
committer | V3n3RiX <venerix@redcorelinux.org> | 2020-04-12 03:41:30 +0100 |
commit | 623ee73d661e5ed8475cb264511f683407d87365 (patch) | |
tree | 993eb27c93ec7a2d2d19550300d888fc1fed9e69 /dev-qt/qtcore/files | |
parent | ceeeb463cc1eef97fd62eaee8bf2196ba04bc384 (diff) |
gentoo Easter resync : 12.04.2020
Diffstat (limited to 'dev-qt/qtcore/files')
-rw-r--r-- | dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch | 98 | ||||
-rw-r--r-- | dev-qt/qtcore/files/qtcore-5.14.2-QLibrary-deadlock.patch | 106 |
2 files changed, 106 insertions, 98 deletions
diff --git a/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch b/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch deleted file mode 100644 index 055794b51964..000000000000 --- a/dev-qt/qtcore/files/qtcore-5.12.3-CVE-2019-18281.patch +++ /dev/null @@ -1,98 +0,0 @@ -From 1232205e32464d90e871f39eb1e14fcf9b78a163 Mon Sep 17 00:00:00 2001 -From: Rainer Keller <Rainer.Keller@qt.io> -Date: Tue, 27 Aug 2019 14:44:48 +0200 -Subject: [PATCH] Fix crash when text contains too many directional chars - -In case a text to be layouted contains more than 128 directional characters -it causes the application to crash - -The function initScriptAnalysisAndIsolatePairs() collects information of -RTL/LTR chaaracters into vector "isolatePairs". The size of the vector is -capped to 128. Later the function generateDirectionalRuns() iterates -the text again and tries to access items from the previously capped vector -above the upper bound. - -Task-number: QTBUG-77819 -Change-Id: Ibb7bf12c12b1db22f43ff46236518da3fdeed26a -Reviewed-by: Simon Hausmann <simon.hausmann@qt.io> ---- - src/gui/text/qtextengine.cpp | 15 +++++++-------- - tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp | 17 +++++++++++++++++ - 2 files changed, 24 insertions(+), 8 deletions(-) - -diff --git a/src/gui/text/qtextengine.cpp b/src/gui/text/qtextengine.cpp -index 2da13289bfd..a7834587b1e 100644 ---- a/src/gui/text/qtextengine.cpp -+++ b/src/gui/text/qtextengine.cpp -@@ -399,6 +399,7 @@ struct QBidiAlgorithm { - analysis[i].bidiDirection = (level & 1) ? QChar::DirR : QChar::DirL; - runHasContent = true; - lastRunWithContent = -1; -+ ++isolatePairPosition; - } - int runBeforeIsolate = runs.size(); - ushort newLevel = isRtl ? ((stack.top().level + 1) | 1) : ((stack.top().level + 2) & ~1); -@@ -440,21 +441,19 @@ struct QBidiAlgorithm { - doEmbed(true, true, false); - break; - case QChar::DirLRI: -- Q_ASSERT(isolatePairs.at(isolatePairPosition).start == i); - doEmbed(false, false, true); -- ++isolatePairPosition; - break; - case QChar::DirRLI: -- Q_ASSERT(isolatePairs.at(isolatePairPosition).start == i); - doEmbed(true, false, true); -- ++isolatePairPosition; - break; - case QChar::DirFSI: { -- const auto &pair = isolatePairs.at(isolatePairPosition); -- Q_ASSERT(pair.start == i); -- bool isRtl = QStringView(text + pair.start + 1, pair.end - pair.start - 1).isRightToLeft(); -+ bool isRtl = false; -+ if (isolatePairPosition < isolatePairs.size()) { -+ const auto &pair = isolatePairs.at(isolatePairPosition); -+ Q_ASSERT(pair.start == i); -+ isRtl = QStringView(text + pair.start + 1, pair.end - pair.start - 1).isRightToLeft(); -+ } - doEmbed(isRtl, false, true); -- ++isolatePairPosition; - break; - } - -diff --git a/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp b/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp -index 9c477589f93..f0a32c2ed40 100644 ---- a/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp -+++ b/tests/auto/gui/text/qtextlayout/tst_qtextlayout.cpp -@@ -138,6 +138,7 @@ private slots: - void noModificationOfInputString(); - void superscriptCrash_qtbug53911(); - void showLineAndParagraphSeparatorsCrash(); -+ void tooManyDirectionalCharctersCrash_qtbug77819(); - - private: - QFont testFont; -@@ -2309,5 +2310,21 @@ void tst_QTextLayout::nbspWithFormat() - QCOMPARE(layout.lineAt(1).textLength(), s2.length() + 1 + s3.length()); - } - -+void tst_QTextLayout::tooManyDirectionalCharctersCrash_qtbug77819() -+{ -+ QString data; -+ data += QString::fromUtf8("\xe2\x81\xa8"); // U+2068 FSI character -+ data += QString::fromUtf8("\xe2\x81\xa7"); // U+2067 RLI character -+ -+ // duplicating the text -+ for (int i = 0; i < 10; i++) -+ data += data; -+ -+ // Nothing to test. It must not crash in beginLayout(). -+ QTextLayout tl(data); -+ tl.beginLayout(); -+ tl.endLayout(); -+} -+ - QTEST_MAIN(tst_QTextLayout) - #include "tst_qtextlayout.moc" --- -2.16.3 diff --git a/dev-qt/qtcore/files/qtcore-5.14.2-QLibrary-deadlock.patch b/dev-qt/qtcore/files/qtcore-5.14.2-QLibrary-deadlock.patch new file mode 100644 index 000000000000..6a9c9921b7d0 --- /dev/null +++ b/dev-qt/qtcore/files/qtcore-5.14.2-QLibrary-deadlock.patch @@ -0,0 +1,106 @@ +From 276fa8383a7535765be7182883ef4aade17ce013 Mon Sep 17 00:00:00 2001 +From: Thiago Macieira <thiago.macieira@intel.com> +Date: Thu, 2 Apr 2020 12:08:41 -0300 +Subject: [PATCH] QLibrary: fix deadlock caused by fix to QTBUG-39642 + +Commit ae6f73e8566fa76470937aca737141183929a5ec inserted a mutex around +the entire load_sys(). We had reasoed that deadlocks would only occur if +the object creation in instance() recursed into its own instance(), +which was already a bug. But we had forgotten that dlopen()/ +LoadLibrary() executes initialization code from the module being loaded, +which could cause a recursion back into the same QPluginLoader or +QLibrary object. This recursion is benign because the module *is* loaded +and dlopen()/LoadLibrary() returns the same handle. + +[ChangeLog][QtCore][QLibrary and QPluginLoader] Fixed a deadlock that +would happen if the plugin or library being loaded has load-time +initialization code (C++ global variables) that recursed back into the +same QLibrary or QPluginLoader object. + +PS: QLibraryPrivate::loadPlugin() updates pluginState outside a mutex +lock, so pluginState should be made an atomic variable. Once that is +done, we'll only need locking the mutex to update errorString (no +locking before loading). + +Fixes: QTBUG-83207 +Task-number: QTBUG-39642 +Change-Id: Ibdc95e9af7bd456a94ecfffd160209304e5ab2eb +Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io> +Reviewed-by: David Faure <david.faure@kdab.com> +--- + src/corelib/plugin/qlibrary.cpp | 2 -- + src/corelib/plugin/qlibrary_unix.cpp | 4 ++++ + src/corelib/plugin/qlibrary_win.cpp | 3 +++ + 3 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/src/corelib/plugin/qlibrary.cpp b/src/corelib/plugin/qlibrary.cpp +index ddb053c26fa..be9d92b2048 100644 +--- a/src/corelib/plugin/qlibrary.cpp ++++ b/src/corelib/plugin/qlibrary.cpp +@@ -576,9 +576,7 @@ bool QLibraryPrivate::load() + + Q_TRACE(QLibraryPrivate_load_entry, fileName); + +- mutex.lock(); + bool ret = load_sys(); +- mutex.unlock(); + if (qt_debug_component()) { + if (ret) { + qDebug() << "loaded library" << fileName; +diff --git a/src/corelib/plugin/qlibrary_unix.cpp b/src/corelib/plugin/qlibrary_unix.cpp +index 017aa97b66a..a5c72f81d96 100644 +--- a/src/corelib/plugin/qlibrary_unix.cpp ++++ b/src/corelib/plugin/qlibrary_unix.cpp +@@ -123,6 +123,7 @@ QStringList QLibraryPrivate::prefixes_sys() + + bool QLibraryPrivate::load_sys() + { ++ QMutexLocker locker(&mutex); + QString attempt; + QFileSystemEntry fsEntry(fileName); + +@@ -213,6 +214,7 @@ bool QLibraryPrivate::load_sys() + } + #endif + ++ locker.unlock(); + bool retry = true; + Handle hnd = nullptr; + for (int prefix = 0; retry && !hnd && prefix < prefixes.size(); prefix++) { +@@ -273,6 +275,8 @@ bool QLibraryPrivate::load_sys() + } + } + #endif ++ ++ locker.relock(); + if (!hnd) { + errorString = QLibrary::tr("Cannot load library %1: %2").arg(fileName, qdlerror()); + } +diff --git a/src/corelib/plugin/qlibrary_win.cpp b/src/corelib/plugin/qlibrary_win.cpp +index 000bf762763..ef58724be8e 100644 +--- a/src/corelib/plugin/qlibrary_win.cpp ++++ b/src/corelib/plugin/qlibrary_win.cpp +@@ -78,6 +78,7 @@ bool QLibraryPrivate::load_sys() + // fileName + // + // NB If it's a plugin we do not ever try the ".dll" extension ++ QMutexLocker locker(&mutex); + QStringList attempts; + + if (pluginState != IsAPlugin) +@@ -95,6 +96,7 @@ bool QLibraryPrivate::load_sys() + attempts.prepend(QDir::rootPath() + fileName); + #endif + ++ locker.unlock(); + Handle hnd = nullptr; + for (const QString &attempt : qAsConst(attempts)) { + #ifndef Q_OS_WINRT +@@ -115,6 +117,7 @@ bool QLibraryPrivate::load_sys() + #ifndef Q_OS_WINRT + SetErrorMode(oldmode); + #endif ++ locker.relock(); + if (!hnd) { + errorString = QLibrary::tr("Cannot load library %1: %2").arg( + QDir::toNativeSeparators(fileName), qt_error_string()); |